picomatch

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.5

CVE-2026-33671 Public exploit

Picomatch has a ReDoS vulnerability via extglob quantifiers

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

micromatch picomatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm

Mar 26, 2026